Extracted

• • Target
    R.F.Q_PURCHASE-ORDER pdf.exe
  • Size 569KB
  • SHA256 a1e44dff73b4a8616ae1b39f3ecf82b457859f3aed8b208ae41e79d7d79c5ef2
  • MD5 cce459bf55049588dd87ce6abd0e96f4
  • SHA1 0c5dbc05b10c369a8f58909f8b6f9872417dd1a1
  • SHA512 62be25c83f2fcbf3b4d4d95368d8ddf5171924f7a0fc3d7e7b0b4c11b844235a42e828e446161e628915ea0095c8ce449358acda6adeca3d83d98c65f9fe806a
  • SSDEEP 12288:H2iNlyWcjy7vMWZ+CsNzEMJALOb9DAMpvzIzeXM6aGLd:H1T5cjyYo+C0/JACV/5aGLd
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2